Possible Denial of Service due to Prometheus Metrics

[joe-warren]

The Prometheus counter that is incremented per request contains a label handler which is set to the path of the request, (code here.

Because this isn't validated, making a call to a large number of endpoints (even if these aren't handled) will make the number of labels grow arbitrary large.

This can inflate the size of the /metrics response, which could be used as part of a denial of service, and could potentially consume a lot of storage in your Prometheus database.